Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 14 replies
  • Subscribers 3 subscribers
  • Views 2917 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem on reinstalling antivirus on computer

daunay olivier

 I've a problem with a computer (win2016) on which I deleted all sophos components + reboot and reinstall from the share of the new server.

All components are well download from the server, but impossible that antivirus part install.

I've tested all solution (desintall manual and SophosZap, clean registry, clean c:\programdata programfile and x86 )

I've tested Sophos Endpoint Defense: How to recover a tamper protected system

ALWAYS the same message in Log : 

2021-04-20 11:47:15 ERROR: Installation failed
2021-04-20 11:47:15 Info: SetupPlugin: Unable to open Application registry key to get Install Path.
2021-04-20 11:47:15 ERROR: Failed to get current install location to register with tamper protection. Error 0x80070002
2021-04-20 11:47:15 ERROR: Failed to update the major update counters (The result of the last run has not been set)

Please help me. 

 Thanks



This thread was automatically locked due to age.
  • 0

    Hello daunay olivier,

    this is from the ALUpdate log, isn't it?
    You say that everything installed except SAVXP (and it does not appear in Programs and Features)? The actual final error is the rather vague ERROR: Installation failed. The rest is just consequential. Guess there is nothing meaningful prior to this message.

    Please check the Sophos Anti-Virus Major Install and Sophos Anti-Virus Major CustomActions logs in %windir%\Temp.

    Christian

  • 0 in reply to QC

    Thank you for your response

    the log with the error was Sophos Anti-Virus Major Install Log

    I control the log Sophos Anti-Virus Major CustomActions Log and found this error :

    2021-04-20 11:47:01 CreateUserGroups: Action started
    2021-04-20 11:47:01 CreateUserGroups: CreateSophosUserGroup: Group SophosUser has been created successfully.
    2021-04-20 11:47:01 CreateUserGroups: CreateSophosUserGroup: Group SophosPowerUser has been created successfully.
    2021-04-20 11:47:01 CreateUserGroups: CreateSophosUserGroup: Group SophosAdministrator has been created successfully.
    2021-04-20 11:47:01 CreateUserGroups: CreateSophosUserGroup: Group SophosOnAccess has been created successfully.
    2021-04-20 11:47:01 CreateUserGroups: PROCESSOR_ARCHITECTURE environment variable is: AMD64
    2021-04-20 11:47:01 CreateUserGroups: Local name of well-known group Administrators is Administrateurs
    2021-04-20 11:47:01 CreateUserGroups: Local name of well-known group PowerUsers is Utilisateurs avec pouvoir
    2021-04-20 11:47:01 CreateUserGroups: Local name of well-known group Users is Utilisateurs
    2021-04-20 11:47:01 CreateUserGroups: Failed to add the members of group PowerUsers to SophosPowerUser group. HRESULT: 0x80070057
    2021-04-20 11:47:01 CreateUserGroups: Adding LOCAL SYSTEM to the SophosAdministrator role in the machine file
    2021-04-20 11:47:01 CreateUserGroups: Action succeeded

    I don't find these usergroups localy like on the other computer ?

  • 0 in reply to daunay olivier

    the SOPHOS installer creates the groups correctly but they are deleted during the rollback of the installation apparently

  • 0 in reply to daunay olivier

    MSI (s) (24:04) [14:15:20:940]: Invoking remote custom action. DLL: C:\windows\Installer\MSIC73A.tmp, Entrypoint: CAQuietExec
    CAQuietExec: driverInstaller
    CAQuietExec:
    CAQuietExec: Installation error: The driver package is not signed.
    CAQuietExec: error:1
    CAQuietExec: Error 0x80070001: Command line returned an error.
    CAQuietExec: Error 0x80070001: CAQuietExec Failed
    CustomAction SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
    MSI (s) (24:C0) [14:15:21:018]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (24:C0) [14:15:21:018]: User policy value 'DisableRollback' is 0
    MSI (s) (24:C0) [14:15:21:018]: Machine policy value 'DisableRollback' is 0
    Fin de l'action 14:15:21 : InstallFinalize. Valeur renvoyée 3.
    MSI (s) (24:C0) [14:15:21:018]: Note: 1: 2318 2:
    MSI (s) (24:C0) [14:15:21:049]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1385460197,LangId=1036,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
    MSI (s) (24:C0) [14:15:21:049]: Executing op: DialogInfo(Type=0,Argument=1036)
    MSI (s) (24:C0) [14:15:21:049]: Executing op: DialogInfo(Type=1,Argument=Sophos Anti-Virus)
    MSI (s) (24:C0) [14:15:21:049]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Annulation en cours de l'action :,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Suppression en cours des fichiers de sauvegarde,CleanupTemplate=Fichier : [1])
    MSI (s) (24:C0) [14:15:21:049]: Executing op: ActionStart(Name=SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (24:C0) [14:15:21:049]: Executing op: ProductInfo(ProductKey={31616A98-3852-49E9-BDD6-77A1AB85571A},ProductName=Sophos Anti-Virus,PackageName=Sophos Anti-Virus.msi,Language=1036,Version=168296458,Assignment=1,ObsoleteArg=0,ProductIcon=ARPPRODUCTICON.exe,,PackageCode={DA891FEE-A03E-4AE7-98FD-7F1E6F27DD3B},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
    MSI (s) (24:C0) [14:15:21:049]: Executing op: ActionStart(Name=SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (24:C0) [14:15:21:049]: Executing op: CustomActionRollback(Action=SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3393,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\windows\TEMP\SwiRebootRequired.txt" /u "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf")
    MSI (s) (24:10) [14:15:21:049]: Invoking remote custom action. DLL: C:\windows\Installer\MSIC7A8.tmp, Entrypoint: CAQuietExec
    CAQuietExec: driverInstaller
    CAQuietExec:
    CAQuietExec: Uninstallation error: Unknown error code: 0xe0000302
    CAQuietExec: error:1
    CAQuietExec: Error 0x80070001: Command line returned an error.
    CAQuietExec: Error 0x80070001: CAQuietExec Failed
    CustomAction SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 but will be translated to success due to continue marking
    MSI (s) (24:C0) [14:15:21:080]: Executing op: ActionStart(Name=SwiServiceRegister.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (24:C0) [14:15:21:080]: Executing op: ActionStart(Name=SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (24:C0) [14:15:21:080]: Executing op: CustomActionRollback(Action=SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3393,Source=BinaryData,Target=UninstallService,CustomActionData=swi_service)
    MSI (s) (24:70) [14:15:21:080]: Invoking remote custom action. DLL: C:\windows\Installer\MSIC7C9.tmp, Entrypoint: UninstallService
    UninstallService: Unable to open service to delete it. Error 1060
    CustomAction SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 but will be translated to success due to continue marking

  • 0 in reply to daunay olivier

    Hello ,

    the log with the error was Sophos Anti-Virus Major Install Log
    I see, thanks.  Whatever caused the install to fail should be in this log. Please search for the French equivalent of Return value 3 (there might be more than one occurrence). Normally the preceding lines have at least some information about the error.

    Christian

  • +1 in reply to QC

    I found 2 occurrences of "Valeur renvoyée 3"

    MSI (s) (18:D0) [14:21:15:079]: Executing op: ActionStart(Name=StartDriverServices,,)
    AddSIPSManagementUser Exit (283)
    MSI (s) (18:D0) [14:21:15:079]: Executing op: CustomActionSchedule(Action=StartDriverServices,ActionType=1025,Source=BinaryData,Target=StartDriverServices,CustomActionData=WIN7_AMD64)
    MSI (s) (18:6C) [14:21:15:079]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2E3D.tmp, Entrypoint: StartDriverServices
    MSI (s) (18:D0) [14:21:15:111]: Executing op: ActionStart(Name=SetThreatLifeTimeRegistryKeyPermissions,,)
    MSI (s) (18:D0) [14:21:15:111]: Executing op: CustomActionSchedule(Action=SetThreatLifeTimeRegistryKeyPermissions,ActionType=1025,Source=BinaryData,Target=SetThreatLifeTimeRegistryKeyPermissions,)
    MSI (s) (18:BC) [14:21:15:111]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2E5D.tmp, Entrypoint: SetThreatLifeTimeRegistryKeyPermissions
    MSI (s) (18:D0) [14:21:15:126]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,)
    MSI (s) (18:D0) [14:21:15:126]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1345,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\SAVService)
    MSI (s) (18:D0) [14:21:15:126]: Executing op: ActionStart(Name=SetupSspUserAccount,,)
    MSI (s) (18:D0) [14:21:15:126]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1089,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\SAVService)
    MSI (s) (18:60) [14:21:15:126]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2E6E.tmp, Entrypoint: SetupSspUserAccount
    SetupSspUserAccount: Initialized.
    SetupSspUserAccount: LoadAccount(SophosSSPUser) failed (error 1332)
    SetupSspUserAccount: Granting permissions to user "NT SERVICE\SAVService"
    MSI (s) (18:D0) [14:21:15:486]: Executing op: ActionStart(Name=SetServiceSecurity,,)
    SetupSspUserAccount: Service is not installed.
    MSI (s) (18:D0) [14:21:15:486]: Executing op: CustomActionSchedule(Action=SetServiceSecurity,ActionType=1025,Source=BinaryData,Target=SetServiceSecurity,)
    MSI (s) (18:40) [14:21:15:486]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2FD6.tmp, Entrypoint: SetServiceSecurity
    MSI (s) (18:D0) [14:21:15:501]: Executing op: ActionStart(Name=SetServiceRecoveryActions,,)
    MSI (s) (18:D0) [14:21:15:501]: Executing op: CustomActionSchedule(Action=SetServiceRecoveryActions,ActionType=1025,Source=BinaryData,Target=SetServiceRecoveryActions,)
    MSI (s) (18:60) [14:21:15:501]: Invoking remote custom action. DLL: C:\windows\Installer\MSI2FE7.tmp, Entrypoint: SetServiceRecoveryActions
    MSI (s) (18:D0) [14:21:15:517]: Executing op: ActionStart(Name=RollbackInstallDeviceControl,,)
    MSI (s) (18:D0) [14:21:15:517]: Executing op: CustomActionSchedule(Action=RollbackInstallDeviceControl,ActionType=1281,Source=BinaryData,Target=RollbackInstallDeviceControl,)
    MSI (s) (18:D0) [14:21:15:532]: Executing op: ActionStart(Name=InstallDeviceControl,,)
    MSI (s) (18:D0) [14:21:15:532]: Executing op: CustomActionSchedule(Action=InstallDeviceControl,ActionType=1025,Source=BinaryData,Target=InstallDeviceControl,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\""C:\ProgramData\Sophos\AutoUpdate\cache\savxp\")
    MSI (s) (18:24) [14:21:15:532]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3007.tmp, Entrypoint: InstallDeviceControl
    MSI (s) (18:D0) [14:21:15:548]: Executing op: ActionStart(Name=SetAdminGroupDescription,,)
    MSI (s) (18:D0) [14:21:15:548]: Executing op: CustomActionSchedule(Action=SetAdminGroupDescription,ActionType=1025,Source=BinaryData,Target=SetAdminGroupDescription,CustomActionData=Les SophosAdministrators peuvent exécuter Sophos Anti-Virus avec un accès total)
    MSI (s) (18:C8) [14:21:15:564]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3018.tmp, Entrypoint: SetAdminGroupDescription
    MSI (s) (18:D0) [14:21:15:579]: Executing op: ActionStart(Name=SetPowerGroupDescription,,)
    MSI (s) (18:D0) [14:21:15:579]: Executing op: CustomActionSchedule(Action=SetPowerGroupDescription,ActionType=1025,Source=BinaryData,Target=SetPowerGroupDescription,CustomActionData=Les SophosPowerUsers peuvent exécuter Sophos Anti-Virus avec le même accès que les SophosUsers mais avec un accès supérieur au nettoyage)
    MSI (s) (18:E0) [14:21:15:579]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3038.tmp, Entrypoint: SetPowerGroupDescription
    MSI (s) (18:D0) [14:21:15:595]: Executing op: ActionStart(Name=SetUserGroupDescription,,)
    MSI (s) (18:D0) [14:21:15:595]: Executing op: CustomActionSchedule(Action=SetUserGroupDescription,ActionType=1025,Source=BinaryData,Target=SetUserGroupDescription,CustomActionData=Les SophosUsers peuvent exécuter Sophos Anti-Virus avec un accès limité à la configuration du contrôle et au nettoyage)
    MSI (s) (18:6C) [14:21:15:595]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3049.tmp, Entrypoint: SetUserGroupDescription
    MSI (s) (18:D0) [14:21:15:611]: Executing op: ActionStart(Name=MsiConfigureServices,,)
    MSI (s) (18:D0) [14:21:15:611]: Executing op: ProgressTotal(Total=2,Type=1,ByteEquivalent=1300000)
    MSI (s) (18:D0) [14:21:15:611]: Executing op: ServiceConfigure(,Name=SAVService,Event=5,ConfigType=5,Argument=1)
    MSI (s) (18:D0) [14:21:15:611]: Changing configuration of service SAVService.
    MSI (s) (18:D0) [14:21:15:611]: Changed configuration of service SAVService with ConfigType SERVICE_CONFIG_SERVICE_SID_INFO
    MSI (s) (18:D0) [14:21:15:611]: Done changing configuration of service SAVService
    MSI (s) (18:D0) [14:21:15:611]: Executing op: ServiceConfigure(,Name=SAVAdminService,Event=5,ConfigType=5,Argument=1)
    MSI (s) (18:D0) [14:21:15:611]: Changing configuration of service SAVAdminService.
    MSI (s) (18:D0) [14:21:15:611]: Changed configuration of service SAVAdminService with ConfigType SERVICE_CONFIG_SERVICE_SID_INFO
    MSI (s) (18:D0) [14:21:15:611]: Done changing configuration of service SAVAdminService
    MSI (s) (18:D0) [14:21:15:611]: Executing op: ActionStart(Name=SetOnAccessGroupDescription,,)
    MSI (s) (18:D0) [14:21:15:626]: Executing op: CustomActionSchedule(Action=SetOnAccessGroupDescription,ActionType=1025,Source=BinaryData,Target=SetOnAccessGroupDescription,CustomActionData=Contient des comptes utilisés par Sophos Anti-Virus lorsqu'il effectue les opérations de contrôle des menaces et de nettoyage)
    MSI (s) (18:70) [14:21:15:626]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3069.tmp, Entrypoint: SetOnAccessGroupDescription
    MSI (s) (18:D0) [14:21:15:642]: Executing op: ActionStart(Name=DisablePUADetection,,)
    MSI (s) (18:D0) [14:21:15:642]: Executing op: CustomActionSchedule(Action=DisablePUADetection,ActionType=1025,Source=BinaryData,Target=DisablePUADetection,CustomActionData=C:\ProgramData\Sophos\Sophos Anti-Virus\Config)
    MSI (s) (18:5C) [14:21:15:642]: Invoking remote custom action. DLL: C:\windows\Installer\MSI3079.tmp, Entrypoint: DisablePUADetection
    MSI (s) (18:D0) [14:21:15:658]: Executing op: ActionStart(Name=DeleteExpiredCaches,,)
    MSI (s) (18:D0) [14:21:15:658]: Executing op: CustomActionSchedule(Action=DeleteExpiredCaches,ActionType=1025,Source=BinaryData,Target=DeleteExpiredCaches,)
    MSI (s) (18:A4) [14:21:15:658]: Invoking remote custom action. DLL: C:\windows\Installer\MSI308A.tmp, Entrypoint: DeleteExpiredCaches
    MSI (s) (18:D0) [14:21:15:673]: Executing op: ActionStart(Name=EnableJournals,,)
    MSI (s) (18:D0) [14:21:15:673]: Executing op: CustomActionSchedule(Action=EnableJournals,ActionType=1025,Source=BinaryData,Target=EnableJournals,)
    MSI (s) (18:E8) [14:21:15:673]: Invoking remote custom action. DLL: C:\windows\Installer\MSI309B.tmp, Entrypoint: EnableJournals
    MSI (s) (18:D0) [14:21:15:689]: Executing op: ActionStart(Name=DisableWebProtection,,)
    MSI (s) (18:D0) [14:21:15:689]: Executing op: CustomActionSchedule(Action=DisableWebProtection,ActionType=1025,Source=BinaryData,Target=DisableWebProtection,CustomActionData=C:\ProgramData\Sophos\Sophos Anti-Virus\Config)
    MSI (s) (18:48) [14:21:15:689]: Invoking remote custom action. DLL: C:\windows\Installer\MSI30AB.tmp, Entrypoint: DisableWebProtection
    MSI (s) (18:D0) [14:21:15:704]: Executing op: ActionStart(Name=DisableSxlLookups,,)
    MSI (s) (18:D0) [14:21:15:704]: Executing op: CustomActionSchedule(Action=DisableSxlLookups,ActionType=1025,Source=BinaryData,Target=DisableSxlLookups,CustomActionData=C:\ProgramData\Sophos\Sophos Anti-Virus\Config)
    MSI (s) (18:A4) [14:21:15:720]: Invoking remote custom action. DLL: C:\windows\Installer\MSI30BC.tmp, Entrypoint: DisableSxlLookups
    MSI (s) (18:D0) [14:21:15:720]: Executing op: ActionStart(Name=CheckSNMPDLLPresence,,)
    MSI (s) (18:D0) [14:21:15:736]: Executing op: CustomActionSchedule(Action=CheckSNMPDLLPresence,ActionType=1025,Source=BinaryData,Target=CheckSNMPDLLPresence,CustomActionData=C:\ProgramData\Sophos\Sophos Anti-Virus\Config)
    MSI (s) (18:F4) [14:21:15:736]: Invoking remote custom action. DLL: C:\windows\Installer\MSI30DC.tmp, Entrypoint: CheckSNMPDLLPresence
    MSI (s) (18:D0) [14:21:15:751]: Executing op: ActionStart(Name=UpdateSXLServerList,,)
    MSI (s) (18:D0) [14:21:15:751]: Executing op: CustomActionSchedule(Action=UpdateSXLServerList,ActionType=1025,Source=BinaryData,Target=UpdateSXLServerList,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\""C:\ProgramData\Sophos\Sophos Anti-Virus\Config")
    MSI (s) (18:20) [14:21:15:751]: Invoking remote custom action. DLL: C:\windows\Installer\MSI30ED.tmp, Entrypoint: UpdateSXLServerList
    MSI (s) (18:D0) [14:21:15:782]: Executing op: ActionStart(Name=ApplySAVControlFile,,)
    MSI (s) (18:D0) [14:21:15:782]: Executing op: CustomActionSchedule(Action=ApplySAVControlFile,ActionType=1025,Source=BinaryData,Target=ApplySAVControlFile,CustomActionData="C:\ProgramData\Sophos\AutoUpdate\cache\savxp\""C:\ProgramData\Sophos\Sophos Anti-Virus\Config")
    MSI (s) (18:9C) [14:21:15:798]: Invoking remote custom action. DLL: C:\windows\Installer\MSI310D.tmp, Entrypoint: ApplySAVControlFile
    MSI (s) (18:D0) [14:21:15:814]: Executing op: ActionStart(Name=GenerateSavMachineId,,)
    MSI (s) (18:D0) [14:21:15:814]: Executing op: CustomActionSchedule(Action=GenerateSavMachineId,ActionType=1025,Source=BinaryData,Target=GenerateSavMachineId,)
    MSI (s) (18:58) [14:21:15:814]: Invoking remote custom action. DLL: C:\windows\Installer\MSI312D.tmp, Entrypoint: GenerateSavMachineId
    MSI (s) (18:D0) [14:21:15:829]: Executing op: ActionStart(Name=RegisterProduct,Description=Inscription en cours du produit,Template=[1])
    MSI (s) (18:D0) [14:21:15:829]: Executing op: ChangeMedia(MediaVolumeLabel=DISK1,MediaPrompt=Veuillez insérer le disque : 1,,BytesPerTick=0,CopierType=0,,,,,,IsFirstPhysicalMedia=1)
    MSI (s) (18:D0) [14:21:15:829]: Executing op: DatabaseCopy(DatabasePath=C:\windows\Installer\9dc78a.msi,ProductCode={31616A98-3852-49E9-BDD6-77A1AB85571A},,,)
    MSI (s) (18:D0) [14:21:15:829]: Note: 1: 1402 2: UNKNOWN\Products\89A6161325839E94DB6D771ABA5875A1\InstallProperties 3: 2
    MSI (s) (18:D0) [14:21:15:829]: Note: 1: 2318 2: C:\windows\Installer\9dc78e.msi
    MSI (s) (18:D0) [14:21:15:829]: File will have security applied from OpCode.
    MSI (s) (18:D0) [14:21:15:829]: Executing op: ProductRegister(UpgradeCode={597B239E-3032-491A-A322-817737925E8A},VersionString=10.8.10.810,HelpLink=www.sophos.fr/support,HelpTelephone= ,InstallLocation=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\,InstallSource=C:\ProgramData\Sophos\AutoUpdate\cache\savxp\,Publisher=Sophos Limited,URLInfoAbout=www.sophos.fr,URLUpdateInfo=http:/.../updates,,NoModify=1,NoRepair=1,,Comments=Protège votre ordinateur et votre réseau contre les menaces ,Contact=Support technique Sophos,,,,EstimatedSize=58259,,,,)
    MSI (s) (18:D0) [14:21:15:829]: Executing op: ProductCPDisplayInfoRegister()
    MSI (s) (18:D0) [14:21:15:829]: Executing op: ActionStart(Name=PublishFeatures,Description=Publication des fonctions du produit,Template=Fonction : [1])
    MSI (s) (18:D0) [14:21:15:829]: Executing op: FeaturePublish(Feature=SAVService,,Absent=2,Component=Vg@q[]0GO?nmG^LCD4kt2y1ew`QzF9TS&39+j5vrAFB8?=f[z8nmu`RXU$4SaNyflE0OU?cWtkY2sAg*CJv{jz)vo=.&s7Mw}i@@*4tG&LM6_=rZL8sao&W+L}RJ_nt0v=b&X9K@)_4CmDhxkHF`F?_BRZ7dn2pUY~GizzPss89K7$F=-b!1e0]64Kvq$@L-_er4aQk!)

    MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=MainComponents,,Absent=2,Component=sprrGUM,$=-[&ltw@0PwS8t,d=~Bl9Fx7YP,u$!X[l'1cG)mZ9]S4!kCb{$IuVIhIE`XT9{hbt=DY3el!u'`3%hL'9TN*q9fia6pkA-3_~J9{8b$sHYm,bPO%5~xceiij94Rl(R5pfNMHu=b?x[T=?&(TgtXr(ePa51?rAl)p?9r`WW.X!oX,nM~fFRY(=0)(^yUawLfIg4)*$6]?A*cZjw=iOw]r_+~b3xUW9^OEK$,mX3l?`F[h.Ao!=51B3@Gk2]!Owe)[k}X,=T~aALA_N=_[ziyG.*7m@0YWkq*u5KmK^*jLJ.H`=j_S*QxCz4u9?9)2k3hi?QTI)griQ0=[_K,qqU-'A.F2oSSV*E6!74S*H6)+=e{gOXz0{PE-Y+q]$R(J9'{&'-Q7RWDrZ071RO5w8eQM8B6g[Ar2tKQZzrNe=e0XoLr^TT5njbNC9aEZ=x`[}V?Mso^X]TF@BT25??u7=dxHrNhM'a+c-A@{9+R'~g*HXdm-3}-^=I[U=^Re^!fg^eqeAKBxLonMArnQchEI]z_%p!JNLs&I9OSwWA.V5xT?D.L.W=Wo?rr$(Q`6ruqi-.Req^wl9'V]Mbj3*fXH4ae7oue2=PMw%wY~RkBbO-^6@b!'94G3'UC$q~JWqX$hUrJk=d*Bs5+WN{JS)7jPz^Og@jsO(bn!(dDVnWISNc$I@6$d5A'(PvkniW1sZCsY@ZHrL_y+BuIWwYuotW3{8gIL]KAx^qU.&snxj(gt9uepMv~]subZJL@z{Y-.?D^6')v'~9v9RZc(jFgL9R-R[.X`Jw3t+`0tdNmC9xSmcpZk-V(zUav*5'`YAc]34O(wZr`2fonKb6Co@8p)6O4OT3W1eHFT1F(8=9Sz(.0g8wR3{7nvCI'+@y6-W^D@g&5F'6awnl-a@t)Mfu2`)61Uhw!21{rk8%JJbBjqW-LQ=-MB[klXA*AIw8je{CjS`,Y!pof.@FbG2PW5zxY=x+TBXgS,@rmm-6
    MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=HomeEdition,,Absent=2,Component=vj+?00,@p95P54q'~A4U)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=ConfigFiles,,Absent=2,Component=4Q3DKM`l9A^xRd=eqM,.LIz+m4,=2=2?zF=(m^gksjInj%8FeAn!zWF}kRS@A)FtjR108A*(6`pbXBO!%zt'$rt(_8i9+@Q5xX.&DIo{]xCw0AjQL2FV)9'QR7DXeKGX5?R-8DYuEH=PrdxWg3r((9F~v'{[&aAkfz'*@uFg,=P&HPAg@f&rs6z_KG$7Z@Sm_2qnJf=FmP^U*n,r*AemwXRtQkiz)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=Resources,,Absent=2,Component=?$?&&WFt`8a&B`.f~7`u_]K_ZW!6z80Rb{`RtQmA0+I,2M+*^A!Oq7j8fv8[[8{xvmn[n?.$('%+n--*-sHCP?+VPAT[pV7l2WvBA}i^0rrH]A}6D?S^U0!+AoHV?%BO+Ax]wSB,NiBp894@j@v_X9Lho`OH@bm-ZC2`yuZ(!9[(i}FzduNl_75Lwf^?_8F?@W!i)M`''iRkI*ZWY@ft]q_=8`d`)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=EngineFiles,,Absent=2,Component=B'H[7pbT+9RjCb&klv}8)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: FeaturePublish(Feature=ServiceComponents,,Absent=2,Component=$F{Ui&C@BA*({-6m[ch8p?)^w@e]UAE]BB3c*I*d}ofI&wxEB=CKG)%vix@QuWPR-@hf%?q$,A8TZ{V5u6ilKVh6,9!Y-}v+egguUq]plY8My@!(.Q9g]C_dyahe_Zx!K?'y}5Ig!$BNy,+MB3~Y*?G~Ah8_5C}MBd@$xK(o09zh6`MQ(R{l,aP=7z70[AT9MABI({,J=WuylnAOV?34xJHfz?(+u-wad?0e&9%E!Luxt8XRTob_fH,I{8(Z=_&^1utaAby.bX73p8rbSi$X0e..p[V+2@fOV@F-nf0ls)yhmsZ]`L$A$?Qk2anN=CKd@My_H289H9mW{@KX%g5vJu7y]L1CP?T$id028`0I6H,PUK7f3@kH!TUL9s[t[C3,h`]lT?EJF$PimCc63j6qDn0?}8K'2@LrMX]QT(wJNxo}r=Aa1+{q^7]s%@'hq^'O4A-}$ldrqg8pLwL(Z*c*[?'8ZTpRVOFBy[K&H=HsY?D$Rz-=k%gS)uR}y6KQr8}{TV'JOMVMMkOqQ&~UM@v[@@StB[?a&,PX,iFM*?3D},350cKc~d4ZO,bq79rbveSUbkN4u'7?W&A3!=}IPYO,^%9R0)H5gnJbt?&aP^pI?z+.,0!}]4a3^97NiX,q))gOag+{VP_w*9G3Q?fJV.@PGS8o$t3oo97FwL*$$e~8VYV.u1uG]=c{r}UlZn~W+Bg_d@0909ta40fBxJwN-KC{C2*vdAOVt1eKP'Y947r*a5ZbO=$HMH,7*d.XnzL)u,Hdc?]a)EPrh`jb.[5%X5&s+?PS22)2-+.h6_6?FQmY'@qdd*i!qk'PrA]SLe.da=vV3%?$]&7'3P2drzji3AH[@ClJU7.u!BlV0Lfv~9(NetU}4xgcY[.'Z?5fe=p$$Yb2nRZWT5eA[fE5dAMbCr]yATI'Xv.ur?~hE=P!VBN-CjLjsh26&fuCD?lEVp^5krd1hNpir]'l-?*5?AZf&felFR!Ev$6=-?D1
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=PublishProduct,Description=Publication en cours des informations sur le produit,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CleanupConfigData()
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\89A6161325839E94DB6D771ABA5875A1\Patches 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Products\89A6161325839E94DB6D771ABA5875A1\Patches 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ProductPublish(PackageKey={DA891FEE-A03E-4AE7-98FD-7F1E6F27DD3B})
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Executing op: UpgradeCodePublish(UpgradeCode={597B239E-3032-491A-A322-817737925E8A})
    MSI (s) (18:D0) [14:21:15:845]: Executing op: SourceListPublish(,,DiskPromptTemplate=[1],,NumberOfDisks=1)
    MSI (s) (18:D0) [14:21:15:845]: Note: 1: 1402 2: UNKNOWN\Installer\Products\89A6161325839E94DB6D771ABA5875A1\SourceList 3: 2
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ProductPublishClient(,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: SourceListRegisterLastUsed(SourceProduct={31616A98-3852-49E9-BDD6-77A1AB85571A},LastUsedSource=C:\ProgramData\Sophos\AutoUpdate\cache\savxp\)
    MSI (s) (18:D0) [14:21:15:845]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (s) (18:D0) [14:21:15:845]: Specifed source is already in a list.
    MSI (s) (18:D0) [14:21:15:845]: User policy value 'SearchOrder' is 'nmu'
    MSI (s) (18:D0) [14:21:15:845]: Adding new sources is allowed.
    MSI (s) (18:D0) [14:21:15:845]: Set LastUsedSource to: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\.
    MSI (s) (18:D0) [14:21:15:845]: Set LastUsedType to: n.
    MSI (s) (18:D0) [14:21:15:845]: Set LastUsedIndex to: 1.
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackRegisterTamperProtectionControlX64,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackRegisterTamperProtectionControlX64,ActionType=1378,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /u /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\TamperProtectionControlX64.dll",)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackRegisterSavShellExtX64,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackRegisterSavShellExtX64,ActionType=1378,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /u /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SavShellExtX64.dll",)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackRegisterSophosOfficeAV,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackRegisterSophosOfficeAV,ActionType=1378,Source=C:\windows\SysWOW64\,Target=REGSVR32.EXE /u /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SophosOfficeAV.dll",)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackRegisterSophosOfficeAVX64,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackRegisterSophosOfficeAVX64,ActionType=1378,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /u /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SophosOfficeAVx64.dll",)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RegisterTamperProtectionControlX64,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RegisterTamperProtectionControlX64,ActionType=1570,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\TamperProtectionControlX64.dll",)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RegisterSavShellExtX64,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RegisterSavShellExtX64,ActionType=1570,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SavShellExtX64.dll",)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RegisterSophosOfficeAV,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RegisterSophosOfficeAV,ActionType=1570,Source=C:\windows\SysWOW64\,Target=REGSVR32.EXE /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SophosOfficeAV.dll",)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RegisterSophosOfficeAVX64,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RegisterSophosOfficeAVX64,ActionType=1570,Source=C:\windows\SysWOW64\,Target="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\NATIVE.EXE" 37 REGSVR32.EXE /s "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\SophosOfficeAVx64.dll",)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: ActionStart(Name=RollbackInstallSecurityCenter,,)
    MSI (s) (18:D0) [14:21:15:845]: Executing op: CustomActionSchedule(Action=RollbackInstallSecurityCenter,ActionType=1281,Source=BinaryData,Target=UninstallSecurityCenter,CustomActionData=10.8.10.810;)
    MSI (s) (18:D0) [14:21:15:861]: Executing op: ActionStart(Name=RunPreLaunchScript,,)
    MSI (s) (18:D0) [14:21:15:861]: Executing op: CustomActionSchedule(Action=RunPreLaunchScript,ActionType=1025,Source=BinaryData,Target=RunPreLaunchScripts,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\""C:\ProgramData\Sophos\AutoUpdate\cache\savxp\""10.8.10.810")
    MSI (s) (18:04) [14:21:15:876]: Invoking remote custom action. DLL: C:\windows\Installer\MSI315D.tmp, Entrypoint: RunPreLaunchScripts
    MSI (s) (18:D0) [14:21:15:876]: Executing op: ActionStart(Name=RegisterDCIfEnabled,,)
    MSI (s) (18:D0) [14:21:15:892]: Executing op: CustomActionSchedule(Action=RegisterDCIfEnabled,ActionType=1537,Source=BinaryData,Target=RegisterDCIfEnabled,)
    MSI (s) (18:D0) [14:21:15:892]: Executing op: ActionStart(Name=StartSAVServices,,)
    MSI (s) (18:D0) [14:21:15:907]: Executing op: CustomActionSchedule(Action=StartSAVServices,ActionType=1537,Source=BinaryData,Target=StartSAVServices,)
    MSI (s) (18:D0) [14:21:15:923]: Executing op: ActionStart(Name=CopySwiFcRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (18:D0) [14:21:15:923]: Executing op: CustomActionSchedule(Action=CopySwiFcRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3073,Source=BinaryData,Target=RenameAndMarkForDelete,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_fc.exe)
    MSI (s) (18:64) [14:21:15:923]: Invoking remote custom action. DLL: C:\windows\Installer\MSI319D.tmp, Entrypoint: RenameAndMarkForDelete
    MSI (s) (18:D0) [14:21:15:923]: Executing op: ActionStart(Name=CopySwiFcToProgramData.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (18:D0) [14:21:15:923]: Executing op: CustomActionSchedule(Action=CopySwiFcToProgramData.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3073,Source=BinaryData,Target=CopyToShadowDir,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_fc.exe)
    MSI (s) (18:10) [14:21:15:923]: Invoking remote custom action. DLL: C:\windows\Installer\MSI319E.tmp, Entrypoint: CopyToShadowDir
    MSI (s) (18:D0) [14:21:15:939]: Executing op: ActionStart(Name=CopyScfDotDatToProgramData.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    CopyToShadowDir: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_fc.exe has been copied to C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\swi_fc.exe
    MSI (s) (18:D0) [14:21:15:939]: Executing op: CustomActionSchedule(Action=CopyScfDotDatToProgramData.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3073,Source=BinaryData,Target=CopyToShadowDir,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\scf.dat)
    MSI (s) (18:E0) [14:21:15:939]: Invoking remote custom action. DLL: C:\windows\Installer\MSI31AE.tmp, Entrypoint: CopyToShadowDir
    MSI (s) (18:D0) [14:21:15:939]: Executing op: ActionStart(Name=SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    CopyToShadowDir: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\scf.dat has been copied to C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\scf.dat
    MSI (s) (18:D0) [14:21:15:954]: Executing op: CustomActionSchedule(Action=SwiServiceRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3393,Source=BinaryData,Target=UninstallService,CustomActionData=swi_service)
    MSI (s) (18:D0) [14:21:15:954]: Executing op: ActionStart(Name=SwiServiceRegister.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (18:D0) [14:21:15:954]: Executing op: CustomActionSchedule(Action=SwiServiceRegister.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3585,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe" /registerService)
    MSI (s) (18:D0) [14:21:15:954]: Executing op: ActionStart(Name=SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (18:D0) [14:21:15:954]: Executing op: CustomActionSchedule(Action=SwiCalloutRollback.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3393,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\windows\TEMP\SwiRebootRequired.txt" /u "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf")
    MSI (s) (18:D0) [14:21:15:954]: Executing op: ActionStart(Name=SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,,)
    MSI (s) (18:D0) [14:21:15:954]: Executing op: CustomActionSchedule(Action=SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101,ActionType=3073,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_di.exe" -r "C:\windows\TEMP\SwiRebootRequired.txt" "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf")
    MSI (s) (18:44) [14:21:15:954]: Invoking remote custom action. DLL: C:\windows\Installer\MSI31BF.tmp, Entrypoint: CAQuietExec
    CAQuietExec: driverInstaller
    CAQuietExec:
    CAQuietExec: Installation error: The driver package is not signed.
    CAQuietExec: error:1
    CAQuietExec: Error 0x80070001: Command line returned an error.
    CAQuietExec: Error 0x80070001: CAQuietExec Failed
    CustomAction SwiCalloutInstall.11DACB83_28A7_4FA6_AF5B_C006E340C101 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
    MSI (s) (18:D0) [14:21:16:048]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (18:D0) [14:21:16:048]: User policy value 'DisableRollback' is 0
    MSI (s) (18:D0) [14:21:16:048]: Machine policy value 'DisableRollback' is 0
    Fin de l'action 14:21:16 : InstallFinalize. Valeur renvoyée 3.

    MSI (s) (18:D0) [14:21:22:170]: Executing op: ActionStart(Name=RunErrorScript,,)
    MSI (s) (18:D0) [14:21:22:170]: Executing op: CustomActionRollback(Action=RunErrorScript,ActionType=1345,Source=BinaryData,Target=RunErrorScripts,CustomActionData="C:\Program Files (x86)\Sophos\Sophos Anti-Virus\""C:\ProgramData\Sophos\AutoUpdate\cache\savxp\""10.8.10.810")
    MSI (s) (18:04) [14:21:22:186]: Invoking remote custom action. DLL: C:\windows\Installer\MSI4A0D.tmp, Entrypoint: RunErrorScripts
    MSI (s) (18:D0) [14:21:22:202]: Executing op: ActionStart(Name=CheckRegForNullDACLs,,)
    MSI (s) (18:D0) [14:21:22:202]: Executing op: ActionStart(Name=RestoreMovedFiles,,)
    MSI (s) (18:D0) [14:21:22:202]: Executing op: CustomActionRollback(Action=RestoreMovedFiles,ActionType=1281,Source=BinaryData,Target=RestoreMovedFiles,CustomActionData=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\)
    MSI (s) (18:64) [14:21:22:202]: Invoking remote custom action. DLL: C:\windows\Installer\MSI4A2D.tmp, Entrypoint: RestoreMovedFiles
    MSI (s) (18:D0) [14:21:22:217]: Executing op: ActionStart(Name=SetUpdateFailed,,)
    MSI (s) (18:D0) [14:21:22:217]: Executing op: CustomActionRollback(Action=SetUpdateFailed,ActionType=1281,Source=BinaryData,Target=SetUpdateFailed,)
    MSI (s) (18:10) [14:21:22:217]: Invoking remote custom action. DLL: C:\windows\Installer\MSI4A3E.tmp, Entrypoint: SetUpdateFailed
    MSI (s) (18:D0) [14:21:22:233]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
    MSI (s) (18:D0) [14:21:22:233]: Error in rollback skipped. Return: 5
    MSI (s) (18:D0) [14:21:22:233]: Note: 1: 2318 2:
    MSI (s) (18:D0) [14:21:22:249]: Note: 1: 2318 2:
    MSI (s) (18:D0) [14:21:22:249]: No System Restore sequence number for this installation.
    MSI (s) (18:D0) [14:21:22:249]: Unlocking Server
    MSI (s) (18:D0) [14:21:22:249]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
    Fin de l'action 14:21:22 : INSTALL. Valeur renvoyée 3.

  • 0 in reply to daunay olivier

    Hello daunay olivier,

    thanks.
    Installation of Web Intelligence (SwiCalloutInstall) fails with: The driver package is not signed.
    Refers to the stuff in %ProgramFiles(x86)%\Sophos\Sophos Anti-Virus\Web Intelligence\. AFAIK the message is issued by swi-di.exe. Is it possible that the server has an issue with the root certificates?

    Christian

  • 0 in reply to QC

    Thanks

    it seems there is no issue with the root certificates

    I can acces correctly to the certificate with MMC

    how can I verify if there is a certificate error

  • 0 in reply to daunay olivier

    Hello daunay olivier,

    not sure this is actually the cause. I also don't know if and where an associated Windows Event is recorded. 
    Even though the Program folder has been removed by the rollback you can check the Digital Signatures of swi_callout.sys and swi_callout.cat in %ProgramData%\Sophos\AutoUpdate\Cache\savxp\program files\Sophos\Sophos Anti-Virus\Web Intelligence\x64. Note the No signature was present in the subject for the .cat's sha256 signature is expected.

    Christian

  • 0 in reply to QC

    hello Christian

    I checked the Digital Signatures of swi_callout.sys and swi_callout.cat in %ProgramData%\Sophos\AutoUpdate\Cache\savxp\program files\Sophos\Sophos Anti-Virus\Web Intelligence\x64

    I found no difference between these and the sames on an other computer without the error

    Olivier

Unfiltered HTML